CVE-2026-9561

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-9561

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9561.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-9561

Published

2026-07-14T07:59:20.706Z

Modified

2026-07-16T03:48:49.376244140Z

Severity

8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

[none]

Details

Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source of the client IP address in audit log entries. The org.eclipse.kura.web2 (Web Console) and org.eclipse.kura.rest.provider (REST API) components use this header as the primary IP source when initializing audit context, and org.eclipse.kura.jetty.customizer unconditionally installs Jetty's ForwardedRequestCustomizer on all HTTP/HTTPS connectors, causing HttpServletRequest.getRemoteAddr() to reflect the attacker-controlled header value. An unauthenticated remote attacker can exploit this vulnerability to bypass IP-based brute-force protections — such as fail2ban — by spoofing the logged IP address to a non-routable value, allowing a brute-force attack to proceed undetected, or to cause a denial of service against a third party by injecting a victim's IP address and triggering a ban on that address.

Database specific

{
    "cwe_ids": [
        "CWE-345",
        "CWE-348",
        "CWE-807"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9561.json",
    "cna_assigner": "eclipse"
}

References

Affected packages

Git / github.com/eclipse-kura/kura

Affected ranges

Type

GIT

Repo

https://github.com/eclipse-kura/kura

Events

Introduced

d78e70cff2404e292cb9876344d171273966a66c

Last affected

ed6e97d9b3cb118cddc7a046dc3b746585abd338

Database specific

{
    "extracted_events": [
        {
            "introduced": "5.0.0"
        },
        {
            "last_affected": "5.6.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9561.json"